CVE-2026-33195
published 2026-03-24CVE-2026-33195: Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's…
PriorityP261critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.72%
52.3th percentile
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | rails | — | — |
| rails | activestorage | < 7.2.3.1 | 7.2.3.1 |
| rails | activestorage | — | — |
| rails | activestorage | — | — |
| rails | activestorage | >= 0 < 7.2.3.1 | 7.2.3.1 |
| rails | activestorage | >= 8.0.0.beta1 < 8.0.4.1 | 8.0.4.1 |
| rails | activestorage | >= 8.1.0.beta1 < 8.1.2.1 | 8.1.2.1 |
| rubyonrails | rails | < 7.2.3.1 | 7.2.3.1 |
| rubyonrails | rails | >= 8.0.0 < 8.0.4.1 | 8.0.4.1 |
| rubyonrails | rails | >= 8.1.0 < 8.1.2.1 | 8.1.2.1 |
Detection & IOCsextracted from sources · hover to see the quote
- →Look for blob keys containing path traversal sequences (e.g. `../`) being passed to Active Storage's DiskService#path_for method, which could indicate exploitation attempts to read, write, or delete arbitrary files outside the storage root directory. ↗
- →Monitor HTTP requests to Rails Active Storage endpoints where blob key parameters contain `../` or URL-encoded equivalents (`%2e%2e%2f`, `%2e%2e/`, `.%2e/`) that may traverse outside the configured storage root. ↗
- ·Only applications that pass user-supplied input directly as Active Storage blob keys are exploitable. Applications using internally generated, trusted blob keys are not affected. ↗
- ·The vulnerability is specific to the DiskService backend of Active Storage (local filesystem storage). Cloud-backed storage services are not impacted by this path traversal issue. ↗
- ·Patched versions are 8.1.2.1, 8.0.4.1, and 7.2.3.1. Applications running prior versions of Rails Active Storage should be prioritized for upgrade. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.08.0HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv8.0HIGH
vendor_debian8.0HIGH
vendor_redhat8.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2026-33195: Active Storage allows users to attach cloud and local files in Rails applications
osv·2026-03-24·CVSS 8.0
CVE-2026-33195 [HIGH] CVE-2026-33195: Active Storage allows users to attach cloud and local files in Rails applications
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
GHSA
Rails Active Storage has possible Path Traversal in DiskService
ghsa·2026-03-23
CVE-2026-33195 [HIGH] CWE-22 Rails Active Storage has possible Path Traversal in DiskService
Rails Active Storage has possible Path Traversal in DiskService
### Impact
Active Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected.
### Releases
The fixed releases are available at the normal locations.
OSV
Rails Active Storage has possible Path Traversal in DiskService
osv·2026-03-23
CVE-2026-33195 [HIGH] Rails Active Storage has possible Path Traversal in DiskService
Rails Active Storage has possible Path Traversal in DiskService
### Impact
Active Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected.
### Releases
The fixed releases are available at the normal locations.
Red Hat
Rails: Active Storage: Active Storage (Rails): Arbitrary file access via path traversal in blob keys
vendor_redhat·2026-03-23·CVSS 8.0
CVE-2026-33195 [HIGH] CWE-22 Rails: Active Storage: Active Storage (Rails): Arbitrary file access via path traversal in blob keys
Rails: Active Storage: Active Storage (Rails): Arbitrary file access via path traversal in blob keys
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
A flaw was found in Active Storage, a component of Rails applications that manages file attachments
Debian
CVE-2026-33195: rails - Active Storage allows users to attach cloud and local files in Rails application...
vendor_debian·2026·CVSS 8.0
CVE-2026-33195 [HIGH] CVE-2026-33195: rails - Active Storage allows users to attach cloud and local files in Rails application...
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-33195 rubygem-activestorage: Active Storage (Rails): Arbitrary file access via path traversal in blob keys [fedora-all]
bugzilla·2026-08-19·CVSS 9.8
CVE-2026-33195 [CRITICAL] CVE-2026-33195 rubygem-activestorage: Active Storage (Rails): Arbitrary file access via path traversal in blob keys [fedora-all]
CVE-2026-33195 rubygem-activestorage: Active Storage (Rails): Arbitrary file access via path traversal in blob keys [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be t
Bugzilla
CVE-2026-33195 Rails: Active Storage: Active Storage (Rails): Arbitrary file access via path traversal in blob keys
bugzilla·2026-03-24·CVSS 9.8
CVE-2026-33195 [CRITICAL] CVE-2026-33195 Rails: Active Storage: Active Storage (Rails): Arbitrary file access via path traversal in blob keys
CVE-2026-33195 Rails: Active Storage: Active Storage (Rails): Arbitrary file access via path traversal in blob keys
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Wiz
CVE-2026-33195 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 4.8
CVE-2026-33195 [MEDIUM] CVE-2026-33195 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-33195 :
Ruby vulnerability analysis and mitigation
DiskService#path_for
../
Source : NVD
## 8
Score
Published March 24, 2026
Severity HIGH
CNA Score 8.0
Affected Technologies
Ruby
Rails
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 9.4
Exploitation Probability (EPSS) N/A
Affected packages and libraries
cpe:2.3:a:rubyonrails:rails
rails
Sources
Chainguard Has Fix Added at: Mar 25, 2026
Debian 11, 14 Severity CRITICAL No Fix Added at: Mar 26, 2026
Debian 12, 13 Severity MEDIUM No Fix Added at: Mar 26, 2026
Echo Severity CRITICAL No Fix Added at: Mar 26, 2026
RubyGems Severity HIGH Has Fix Added at: Mar 24, 2026
Linux Severity CRITICAL Has Fix Added at: Mar 24,
https://github.com/rails/rails/commit/4933c1e3b8c1bb04925d60347be9f69270392f2chttps://github.com/rails/rails/commit/9b06fbc0f504b8afe333f33d19548f3b85fbe655https://github.com/rails/rails/commit/a290c8a1ec189d793aa6d7f2570b6a763f675348https://github.com/rails/rails/releases/tag/v7.2.3.1https://github.com/rails/rails/releases/tag/v8.0.4.1https://github.com/rails/rails/releases/tag/v8.1.2.1https://github.com/rails/rails/security/advisories/GHSA-9xrj-h377-fr87https://access.redhat.com/security/cve/CVE-2026-33195https://bugzilla.redhat.com/show_bug.cgi?id=2450546https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33195.json
2026-03-24
Published